Your blanket statement isn't true. OVPN for instance has gone to court to protect its data: https://www.ovpn.com/en/blog/ovpn-wins-court-order

They are a very good alternative among others.

Been a customer since they went to court for TPB and I read about their legal fee insurance and the lot. Too bad both are Swedish (I'm Swedish).

But yeah, I'd say Mullvad and OVPN has proven themselves over the years, met a mullvad employee in IRC discussing wireguard when it was still an earlybird, they're a good team.

Absolutely no way to know they are good and other is bad. The entire VPN industry is “trust us bro”. Which works until it doesn’t.

Would a 3rd party audit work?

https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...

That’s very good. But what do I know about “Cure53” other than they are saying “Yea, trust them bro”.

Is Cure53 incorruptible? Would there be any blip in the world if they were not and Mull was really an NSA op?

I’m not saying I don’t trust Mull over say, Nord. I am saying the nature of the whole thing is non-falsifiable with our existing technologies. We can only determine who was lying by looking back after an incident, and most are kept secret.

So far their track record seems good enough. I mean if you have NSA on your threat model you'll have to take this into account... But most don't.

cure53 has an impeccable reputation and delivered some of the best security analysis there is.

Most of them are also public and on github.

https://github.com/cure53/Publications

audits are only valid for that one instant in time when it was performed. anything could have changed after the fact.

You could say the same about all auditing. A restaurant could have changed its food hygiene standards since it was audited. But a company with a history of periodic and successful audits is certainly a good trust marker for me.

Restaurants routinely can't uphold their standards and often get wildly different results on every inspection. But yes I do say the same about all audits.

That is the entire tech industry. No audits, no repercussions for screw ups.

Why do the other popular VPNs not have any integrity left?

A lot of them have been gobbled up by Kape or otherwise proven to keep logs/data when they claim they don't https://restoreprivacy.com/kape-technologies-owns-expressvpn...

Oh man I thought Private Internet Access was still one of the independent VPNs. I feel duped. :/

PIA before the Kape acquisition was owned by parent company London Trust Media. The owner is Andrew Lee, who was best buddies with Mark Karpeles responsible for the MtGox collapse and defrauding all the users of the exchange. Unfortunately the Japanese government let him out of jail and Andrew Lee decided to make his old friend the CTO of the company. Andrew Lee is also the guy behind the shady "sale" of the nonprofit Freenode that caused everyone to jump ship to LiberaChat.

I feel like it's probably more trustworthy under Kape than a CEO and CTO surrounded by a long history of lies, fraud, and general scumbag behavior.

Wait, Andrew Lee, despoiler of Freenode, also associated with the MtGox guy?! The weirder bits of the internet are apparently extremely incestuous.

Birds of a feather and all that.

https://www.privateinternetaccess.com/blog/why-i-hired-mt-go...

That's the same rasengan you'll occasionally see on HN.

PIA continues to prove in court over and over again that they do not keep traffic logs. The extreme fear mongering over Kape has never been backed up by any evidence other than "they used to do bad things under their previous management." As I always say in these threads, all the people who shill Mullvad over everything probably just use them for web-browsing or adjacent activities, and not anything that requires a specialty product like p2p or bypassing national firewalls.

>all the people who shill Mullvad over everything probably just use them for web-browsing or adjacent activities, and not anything that requires a specialty product like p2p or bypassing national firewalls.

On the contrary. Mullvad gives you more flexibility than PIA in that regard and doesn't limit you to whatever features are built into the client like PIA does. You can build tunnels to whatever endpoint in whichever country you want. You can associate multiple ports to your tunnel or separate tunnels for inbound connections. It's very convenient if you want a P2P tunnel where you can get a wireguard interface on the client and then configure your P2P application to only use that tunnel so that there's no chance of leaks (Up to you if you want to also configure the P2P service to use DNS over the VPN or just the system resolver if you don't care) and you don't have to tunnel everything over the same VPN. You can have multiple interfaces going to different applications if you wanted. You have the flexibility to configure your client in whatever way you want without having to deal with proprietary endpoints to request a temporary forwarded port for the connection like what PIA makes you use.

I used to use PIA before the owner hired con artist Mark Karpeles as the CTO and jumped ship when that happened. Even though I only picked Mullvad because it was recommended on HN and wasn't PIA, I much prefer it from a technical standpoint. If I knew how much better it was originally I never would have went for the cheaper more popular option of PIA. People shilling Mullvad are probably doing so because it has many technical advantages over traditional VPNs used by more casual customers. Mullvad also supports bridge servers for shadowsocks. I've never had an opportunity to test it but I'd expect Mullvad to be more reliable in China than PIA.

PIA is cheap, and they don't seem to keep traffic logs. That's basically all they have going for them.

Where can I learn more about this p2p thing?

Anecdotally PIA performance seemed to drop around then, port forwarding was frequently broken and Wireguard wasn't making much progress (looks like maybe they've finally rolled it out now)

Maybe things were already bad before Kape but it was around the same time

They got bought sometime last year. I was a very happy customer until that announcement.

and then freenode had a hard fork! weird week.

That's two of us. I used NordVPN for years. Not any more.

Seems more like a reaction to inflation.

What about ovpn.com?

AirVPN seems to be quite good, and ethical.

I've been using AirVPN for many years now and is has always been reliable and fast for me. Recently they introduced Wireguard support.

Reliable and fast has nothing to do with integrity and anyone can build such a service.

How about ivpn or perfect privacy?

Perfect-Privacy still has integrity left.

Someone hacked into their Malmoe server a year ago or so, and found that they indeed run everything in RAM disks and aren't logging at all. Happened via the management interface. But please take this information with a grain of salt, as the write up for this exploitation has been vanished from the internet (or I am just unable to find it). *

However, there are still articles about how they've been raided multiple times [1][2][3] in the past, and the police never found any logs.

[1] https://lists.torproject.org/pipermail/tor-talk/2010-August/...

[2] https://torrentfreak.com/police-seize-two-perfect-privacy-vp...

[3] https://www.ip-insider.de/hausdurchsuchung-bei-erfurter-vpn-...

* Also, I believe that this kind of pwnage could've happened to every VPN provider. Always use VPN chains with multiple locations and always keep in mind that your VPN could have been compromised. Don't just rely on a single hoster which just shifts the liability from your ISP to another single point of failure. But this is probably still better than LE just having to call comcast. :)

Edit: ovpn.to is probably worth taking a look too. I remember that the admin grows cannabis in his basement (still illegal in Germany) and provides all users with access to warez via Usenet NNTP. Do with that info what you want.

> Someone hacked into their Malmoe server a year ago or so, and found that they indeed run everything in RAM disks and aren't logging at all

Hypothetically, without breaking into the network control plane, the hacker could have completely missed the existence of port mirror to a second read-only system that does logging for lawful intercepts.

Protonvpn?

That's just mullvad with a different name

I believe that would be Firefox/Mozilla VPN

Yeah you're right, I'm sorry. I got those mixed up.